Practical and Flexible Kernel CFI Enforcement using eBPF

Jinghao Jia, Michael V. Le, Salman Ahmed, Dan Williams and Hani Jamjoom

Proceedings of the 1st Workshop on eBPF and Kernel Extensions

New York, USA, Sep 2023

Abstract. Enforcing control flow integrity (CFI) in the kernel (kCFI) can prevent control-flow hijack attacks. Unfortunately, current kCFI approaches have high overhead or are inflexible and cannot support complex context-sensitive policies. To overcome these limitations, we propose a kCFI approach that makes use of eBPF (eKCFI) as the enforcement mechanism. The focus of this work is to demonstrate through implementation optimizations how to overcome the enormous performance overhead of this approach, thereby enabling the potential benefits with only modest performance tradeoffs.

Link. https://dl.acm.org/doi/pdf/10.1145/3609021.3609293

Bibtex.

@inproceedings{jamjoom-ebpf-2023,
author = {Jinghao and Jia and Michael V. and Le and Salman and Ahmed and Dan and Williams and Hani and Jamjoom},
title = {{Practical and Flexible Kernel CFI Enforcement using eBPF}},
booktitle = {Proceedings of the 1st Workshop on eBPF and Kernel Extensions},
address = {New York, USA},
month = {Sep},
year = {2023}
}